Index: sys/net/route/nhop_ctl.c
===================================================================
--- sys/net/route/nhop_ctl.c
+++ sys/net/route/nhop_ctl.c
@@ -105,6 +105,9 @@
 							2 * CACHE_LINE_SIZE)
 #define	NHOP_PRIV_ALIGNED_SIZE		roundup2(sizeof(struct nhop_priv), \
 							2 * CACHE_LINE_SIZE)
+
+#define	MULTI_BIT_SET(x)	(x && (x & (x - 1))) /* Inverse of IS_POW2() */
+
 void
 nhops_init(void)
 {
@@ -376,12 +379,16 @@
 alter_nhop_from_info(struct nhop_object *nh, struct rt_addrinfo *info)
 {
 	struct sockaddr *info_gw;
+	int flags;
 	int error;
 
 	/* Update MTU if set in the request*/
 	set_nhop_mtu_from_info(nh, info);
 
-	/* XXX: allow only one of BLACKHOLE,REJECT,GATEWAY */
+	/* allow only one of BLACKHOLE,REJECT,GATEWAY */
+	flags = nh->nh_priv->rt_flags & (RTF_BLACKHOLE | RTF_REJECT | RTF_GATEWAY);
+	if (MULTI_BIT_SET(flags))
+		return (EINVAL);
 
 	/* Allow some flags (FLAG1,STATIC,BLACKHOLE,REJECT) to be toggled on change. */
 	nh->nh_priv->rt_flags &= ~RTF_FMASK;
Index: tests/sys/net/routing/Makefile
===================================================================
--- tests/sys/net/routing/Makefile
+++ tests/sys/net/routing/Makefile
@@ -6,6 +6,7 @@
 
 ATF_TESTS_C +=	test_rtsock_l3
 ATF_TESTS_C +=	test_rtsock_lladdr
+ATF_TESTS_SH+=	test_route_modifier
 
 ${PACKAGE}FILES+=	generic_cleanup.sh
 ${PACKAGE}FILESMODE_generic_cleanup.sh=0555
Index: tests/sys/net/routing/test_route_modifier.sh
===================================================================
--- tests/sys/net/routing/test_route_modifier.sh
+++ tests/sys/net/routing/test_route_modifier.sh
@@ -0,0 +1,92 @@
+# $FreeBSD$
+#
+# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+#
+# Copyright (c) 2020 Neel Chauhan
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+
+. $(atf_get_srcdir)/../../common/vnet.subr
+
+atf_test_case "change_route_modifier" "cleanup"
+change_route_modifier_head()
+{
+	atf_set descr 'change route with modifier test'
+	atf_set require.user root
+}
+
+change_route_modifier_body()
+{
+	vnet_init
+
+	epair=$(vnet_mkepair)
+
+	vnet_mkjail dana ${epair}b
+
+	ifconfig ${epair}a up
+	ifconfig ${epair}a inet 192.0.2.1/24
+
+	jexec dana ifconfig ${epair}b inet 192.0.2.2/24 up
+
+	jexec dana route add 198.51.100.0/24 192.0.2.1 -reject
+	atf_check -s exit:1 -o ignore -e ignore jexec dana route change 198.51.100.0/24 192.0.2.1 -blackhole
+}
+
+change_route_modifier_cleanup()
+{
+	vnet_cleanup
+}
+
+atf_test_case "change_route_modifier_v6" "cleanup"
+change_route6_modifier_head()
+{
+	atf_set descr 'change IPv6 route with modifier test'
+	atf_set require.user root
+}
+
+change_route6_modifier_body()
+{
+	vnet_init
+
+	epair=$(vnet_mkepair)
+
+	vnet_mkjail astrid ${epair}b
+
+	ifconfig ${epair}a up
+	ifconfig ${epair}a inet6 2001:db8:6666::1/64
+
+	jexec astrid ifconfig ${epair}b inet6 2001:db8:6666::2/64 up
+
+	jexec astrid route add -6 2001:db8:6667::/64 2001:db8:6666::1 -reject
+	atf_check -s exit:1 -o ignore -e ignore jexec astrid route change -6 2001:db8:6667::/64 2001:db8:6666::1 -blackhole
+}
+
+change_route6_modifier_cleanup()
+{
+	vnet_cleanup
+}
+
+atf_init_test_cases()
+{
+	atf_add_test_case "change_route_modifier"
+	atf_add_test_case "change_route6_modifier"
+}